What Is Control Testing?
Control testing is the process of evaluating whether controls are properly designed and operating effectively to mitigate the risks they are intended to address. It is a core component of internal audit, compliance reviews, and governance assurance — providing evidence that the control environment is functioning as intended.
Design Effectiveness vs. Operating Effectiveness
Design effectiveness evaluates whether the control is properly designed to mitigate the risk — does it address the right risk, is it robust enough, and is it integrated into the process? Operating effectiveness evaluates whether the control is actually working in practice — is it consistently applied, by the right people, at the right time, with documented evidence? Both must be tested for assurance.
Testing Methods
Common testing methods include: inquiry (interviewing control owners), observation (watching the control being performed), inspection (examining documentation and evidence), re-performance (independently performing the control to verify results), and walkthroughs (tracing a transaction through the control process). The method depends on the control type and the assurance required.
Testing Frequency
Testing frequency should be risk-based: key controls are typically tested annually, while less critical controls may be tested every 2-3 years. Controls with prior failures or changes should be tested more frequently. Event-triggered testing may be needed after incidents, control changes, or organizational changes. A risk-based testing schedule ensures resources are focused where they matter most.
How MPG Supports Control Testing
MPG provides control testing schedules, test documentation, evidence collection, deficiency tracking, and remediation workflows. Test results feed into control effectiveness ratings, which update residual risk calculations. Testing evidence is organized and audit-ready, and deficiencies are tracked through to remediation with full audit trails.
Key Takeaways
- Control testing evaluates both design effectiveness and operating effectiveness
- Common methods: inquiry, observation, inspection, re-performance, and walkthroughs
- Testing frequency should be risk-based — key controls tested annually
- Test results update control effectiveness ratings and residual risk calculations
Frequently Asked Questions
Who should perform control testing?
Control testing is typically performed by internal audit (for independent assurance), compliance teams (for regulatory compliance), or control owners (for self-assessment). Internal audit provides the most independent assurance, but self-assessment by control owners is valuable for ongoing monitoring. MPG supports all approaches with structured testing workflows.
What is a control deficiency?
A control deficiency is a weakness in the design or operation of a control. A significant deficiency is one that could materially affect the organization's ability to meet its objectives. A material weakness is a significant deficiency that has actually resulted in a material failure. Deficiencies should be tracked, rated, and remediated. MPG tracks deficiencies through to remediation with full audit trails.